CVE-2026-81926

Executive Summary

CVE-2026-81926 is a stored/reflected cross-site scripting (XSS) vulnerability in Concrete CMS versions 9.4.0 through 9.5.2, affecting the location panel's duplicate-path confirmation dialog. The check endpoint returned the submitted page path unmodified in its JSON response, and client-side JavaScript inserted each value into the dialog as raw HTML, allowing a crafted page path to execute script in the editor's authenticated browser session. The impact is limited by the requirement for authenticated editor privileges and user interaction, but successful exploitation enables script execution within an authenticated session — potentially leading to session hijacking, account manipulation, or privileged action abuse in the CMS administrative interface.

Technical Analysis

The vulnerability resides in Concrete CMS's location panel, a UI component used by authenticated editors to manage and confirm page path assignments. According to the NVD description, the flaw stems from two compounding weaknesses:

1. Insufficient output encoding on the server side: The panel's check endpoint accepted a submitted page path and returned it unmodified within its JSON response. This means that if an attacker supplied a path containing HTML or script-bearing characters, the server would echo those characters back verbatim in the response body without escaping or sanitizing them.

2. Unsafe client-side DOM insertion: Client-side JavaScript consumed that JSON response and inserted each returned value directly into the duplicate-path confirmation dialog as raw HTML. Because the value was treated as markup rather than text, any HTML embedded in the path was rendered and executed in the editor's browser context.

This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting) pattern, specifically manifesting as DOM-based XSS via a JSON endpoint that fails to neutralize output before it is placed into an HTML sink. The attack surface is the location panel's check endpoint, reachable by an authenticated user with page-editing privileges. The "colliding page paths" observed in the description refers to the dialog's purpose: warning an editor when two pages would occupy the same path. An attacker leverages this legitimate UI flow by submitting a crafted path that collides with an existing one, triggering the dialog and delivering the payload.

Notably, the CVSS v4.0 vector includes AT:P (Attack Requirements: Present), meaning the attack depends on conditions outside the attacker's direct control — here, the victim editor must encounter and interact with the crafted path within the panel dialog. PR:H (Privileges Required: High) reflects that the attacker needs editor-level access to submit the malicious path, while UI:P (User Interaction: Passive) indicates that a victim's involvement beyond basic browsing is required to trigger rendering. The VC:L/VI:L/VA:L subscores confirm limited confidentiality, integrity, and availability impact, and the SC:N/SI:N/SA:N values confirm no impact on subsequent systems. The vendor assigned a CVSS v4.0 score of 2.0, consistent with a low-severity, constrained-context XSS rather than a wormable or unauthenticated flaw.

No public proof-of-concept, exploit code, or Nuclei template is available. The technical mechanism is nonetheless well understood because it follows a common and documented class of DOM-based XSS arising from unescaped reflected values in administrative interfaces.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the specific behaviors described in the NVD entry. No function names, endpoints, or parameter names beyond those in the description are asserted.

1. Reconnaissance / Target Identification: The attacker identifies a Concrete CMS deployment running a vulnerable version (9.4.0 to 9.5.2). Detection may be performed via Shodan dorks such as http.html:"concrete5" or product:"Concrete CMS". The attacker must possess or obtain an account with page-editing privileges, since the location panel and its check endpoint are accessible only to authenticated editors.

2. Triggering the Flaw Class: The attacker crafts a page path value that both collides with an existing page path (so the duplicate-path confirmation dialog is presented) and embeds an XSS payload. The crafted path is submitted through the location panel. Because the server-side check endpoint does not escape the returned path value, the payload is reflected back in the JSON response.

3. Payload Delivery / Execution: When the client-side JavaScript inserts the returned path into the duplicate-path confirmation dialog as raw HTML, the embedded script executes in the context of the editor's browser session. The XSS payload is therefore delivered via the dialog rendering event and fires in the authenticated editor's session.

4. Post-Exploitation Impact: Script execution within the editor's session could allow the attacker to read page content within the same origin, tamper with CMS configuration available to that session, or perform actions on behalf of the victimized editor. The CVSS vector constrains this to low confidentiality, integrity, and availability impact, and no downstream/scope impact. In a higher-privileged victim scenario, the consequences could broaden to administrative configuration changes or session token theft, though the stated vector does not assert these outcomes.

Because the vulnerability requires editor privileges and user interaction, exploitation is typically part of a targeted or insider-adjacent attack rather than mass internet exploitation.

Impact Assessment

The CVSS v4.0 vector is CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N, with a base score of 2.0 assigned by the Concrete CMS security team.

• Attack Vector (AV:N): The flaw is exploitable over the network, not purely locally.
• Attack Complexity (AC:L): Once prerequisites are met, no special conditions complicate exploitation.
• Attack Requirements (AT:P): The attack depends on the presence of a colliding page path scenario and rendering of the confirmation dialog — conditions outside the attacker's direct control.
• Privileges Required (PR:H): High privileges are needed — the attacker must be an authenticated editor.
• User Interaction (UI:P): Passive interaction from a victim editor is required, as the dialog must be rendered in their session.
• Confidentiality / Integrity / Availability (VC:L/VI:L/VA:L): Limited impact across all three dimensions.
• Subsequent System Impact (SC:N/SI:N/SA:N): No impact on systems beyond the vulnerable component.

Business impact: For organizations running Concrete CMS as a public-facing or internal content management platform, this flaw allows an authenticated editor to run script in another editor's or administrator's session. Depending on the victim's privileges, this could facilitate content tampering, privilege escalation within the CMS, or session-related abuse. The limited CVSS subscores and the required authenticated, interactive delivery chain reduce the practical severity, but the vulnerability is relevant to enterprises where content editors are semi-trusted or where editorial accounts are broadly distributed.

Blast radius: Any deployment of Concrete CMS 9.4.0 through 9.5.2 with the location panel in active use. Because no patch is available (patch confidence 0/4), all affected versions remain exposed until mitigating controls are applied or a fix is released.

Detection Guidance

Sigma Rule

title: Concrete CMS Location Panel Duplicate-Path XSS Attempt
id: 8f2e1c44-9b7a-4d3e-a1f0-7c6d2b9e5a11
status: experimental
description: Detects requests to the Concrete CMS location panel check endpoint containing HTML/script-bearing path values that may trigger CVE-2026-81926
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-81926
author: valtersit.com Threat Intelligence
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_uri:
    cs-uri-stem|contains: '/dashboard'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'onload='
      - 'javascript:'
  condition: selection_method and selection_uri and selection_payload
falsepositives:
  - Legitimate administrative content containing HTML-like text
level: medium
tags:
  - attack.t1190
  - cwe.79

YARA Rule

rule CVE_2026_81926_Concrete_CMS_XSS_Payload
{
    meta:
        description = "Detects XSS payloads targeting the Concrete CMS location panel duplicate-path dialog (CVE-2026-81926)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-81926"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $xss1 = "<script" ascii nocase
        $xss2 = "javascript:" ascii nocase
        $xss3 = "onerror=" ascii nocase
        $xss4 = "onload=" ascii nocase
        $xss5 = "<img src" ascii nocase
        $xss6 = "<svg" ascii nocase
        $cms1 = "concrete" ascii nocase
        $cms2 = "ccm-" ascii nocase
        $path = "path" ascii nocase

    condition:
        uint16(0) == 0x3C3F or
        (2 of ($xss*) and $path) or
        (any of ($xss*) and any of ($cms*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-81926 Concrete CMS Location Panel Duplicate-Path XSS Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"dashboard"; nocase; http.uri; content:"path"; nocase; http.uri; pcre:"/(%3C|<)script|javascript:|onerror=|onload=/i"; classtype:web-application-attack; reference:cve,2026-81926; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-81926; sid:202681926; rev:1;)

Elastic Detection

any where
  event.category == "web" and
  process.name : ("apache", "nginx", "php-fpm") and
  (
    url.path : "*dashboard*" and
    url.path : "*path*" and
    (
      url.query : "*<script*" or
      url.query : "*javascript:*" or
      url.query : "*onerror=*" or
      url.query : "*onload=*" or
      url.query : "*%3Cscript*"
    )
  )

Splunk SPL Query

index=web sourcetype=access_combined
| eval path_lc = lower(uri_path), query_lc = lower(uri_query)
| where (match(path_lc, "dashboard") AND match(path_lc, "path"))
| where (match(query_lc, "<script") OR match(query_lc, "%3cscript") OR match(query_lc, "javascript:") OR match(query_lc, "onerror=") OR match(query_lc, "onload="))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, host, uri, http_user_agent
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-81926,">
  <rule id="100926" level="8">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/dashboard</field>
    <field name="url">path</field>
    <regex type="pcre2">(?i)(%3C|<)script|javascript:|onerror=|onload=</regex>
    <description>Possible CVE-2026-81926: Concrete CMS location panel duplicate-path XSS attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,cve_2026_81926,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Affected versions 9.4.0 through 9.5.2 should be treated as unfixed until the vendor releases an advisory or update.

1) Immediate mitigations (no official patch available):

• Restrict editor accounts to trustworthy personnel and enforce least privilege. Because exploitation requires editor-level authenticated access, reducing and auditing editor accounts narrows the attack surface.
• Deploy a Web Application Firewall (WAF) with rules blocking HTML/script-bearing characters (e.g., <, >, <script, javascript:, onerror=, onload=) in requests to the dashboard and location panel endpoints. Note that WAF coverage for URL-encoded variants should be validated.
• Monitor web server logs for requests to the location panel and dashboard paths containing HTML or script-like payloads (see Detection Guidance rules above).
• Consider temporarily disabling or restricting use of the location panel if operationally feasible.

2) Patch / upgrade steps:

• Monitor the Concrete CMS security advisories and release notes for a fixed version addressing this issue. No fixed version is identified in the available data.
• Once a patch is released, upgrade all deployments from 9.4.0–9.5.2 to the vendor-recommended fixed version, then re-validate the location panel behavior.
• Because no official patch reference exists, do not assume community workarounds are sufficient.

3) Long-term hardening:

• Enforce output encoding on all server endpoints returning user-controlled data, particularly those feeding JSON consumed by client-side JavaScript.
• Implement a Content Security Policy (CSP) that disallows unsafe inline script execution, reducing the impact of DOM-based XSS sinks.
• Adopt a secure-by-default front-end framework or DOM sanitization library for inserting dynamic values into dialogs and panels.
• Add regression tests ensuring submitted paths are HTML-escaped before client-side rendering.
• Track CVSS v4.0 and vendor advisories for Concrete CMS as part of routine patch management.

References

1. NVD — CVE-2026-81926: https://nvd.nist.gov/vuln/detail/CVE-2026-81926
2. Concrete CMS Security Advisories / Release Notes (vendor): https://www.concretecms.org/
3. Tenzai — Researcher acknowledgement (Yonatan Drori, reported the vulnerability)
4. CWE-79 — Improper Neutralization of Input During Web Page Generation (Cross-Site Scripting): https://cwe.mitre.org/data/definitions/79.html
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-81926 not listed (as of available data): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild status: No evidence of exploitation in the wild. CISA KEV: NO. EPSS score: 0.00309 (23.7th percentile), indicating a low predicted likelihood of near-term exploitation. No public PoC, exploit code, or Nuclei template is available. No known threat actor campaigns associated with this CVE. The constrained exploit prerequisites (authenticated editor access, user interaction, and presence of a colliding path scenario) limit mass-exploitation potential; however, the absence of a patch means targeted abuse by insiders or attackers holding editorial credentials remains a possibility.